I ran into something similar on one occasion, I suggest you check the
'cache_host' line for the tcp (http) port & icp port numbers. If you have the
tcp port number wrong but the icp port correct you will send icp queries
correctly and received UDP_HIT_OBJ's that fool you into thinking the
configuration is correct but large objects will fail since you don't have the
correct tcp port in your config file. From memory 'ERR_CONNECT_FAIL ...' is
the
error you get in this case.

A lot of proxy servers DONT use the 3128 address for proxy server tcp
(http) port. It would be a good idea if multiple http ports could specified
so that exisiting port could continue to be supported and still have 3128
active as well.

The http://www.nlanr.net/Cache/Tracker/ registration database is useful
in these cases for checking your config against your neighbour/parent(s).
The registration database needs to be promoted more as a solution to this
problem if nothing else.